Qiata FTA 1.70.19 Cross Site Scripting Vulnerability

Product: Qiata FTA
Manufacturer: Secudos GmbH
Affected Version(s): <= Qiata FTA 1.70.19
Tested Version(s): Qiata FTA 1.70.19
Vulnerability Type: Cross-Site Scripting (CWE-79)
Risk Level: Medium
Solution Status: Solved
Manufacturer Notification: 2020-06-17
Solution Date: 2020-08-12
Public Disclosure: 2020-09-28
CVE Reference: CVE-2020-14294
Author of Advisory: Patrick Hener, SySS GmbH
 
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
 
Overview:
 
Qiata FTA is a secure file transfer appliance.
 
The manufacturer describes the product as follows (see [1]):
 
"Qiata File Transfer Appliances (FTAs) provide the ability to easily and
securely exchange files with internal or external users."
 
Due to insufficient input validation of user-provided input, it is
vulnerable
to cross-site scripting.
 
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
 
Vulnerability Details:
 
Within every transfer initiated, both the sender and the receiver of the
transfer are able to communicate via a comment function.
 
This comment function does in fact alter user input and change appearances
of the special characters '<' and '>' by flipping the direction of the
special
character. Also, quotation marks are escaped properly.
 
An attacker can use the behavior to construct a malicious string, which will
embed persistent cross-site scripting within the transfer comments. The
exploit will be executed when viewing the transfer comments.
 
For a user not registered within the file transfer appliance, the
exploit will
be executed directly when opening the provided transfer URL.
 
This vulnerability is also discovered at the global notice board where
no escaping could be identified.
 
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
 
Proof of Concept (PoC):
 
The following string will result in persistent cross-site scripting
displaying the message "Persistent XSS by SySS GmbH" when executed. All an
attacker needs to do is to enter the malicious string as a comment to a
transfer.
 
">img src=x
onerror=alert(String.fromCharCode(80,101,114,115,105,115,116,101,
110,116,32,88,83,83,32,98,121,32,83,121,83,83,32,71,109,98,72)) /<"
 
 
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
 
Solution:
 
The vulnerability was fixed with version Qiata FTA 2.00.00. Update to at
least this version.
 
#  0day.today [2020-10-01]  #